Vulnerabilities in mockoon

3 results

CVE-2025-59049HIGHMockoon has a Path Traversal and LFI in the static file serving endpointEPSS 1.8%CVE-2026-59149MEDIUMMockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)EPSS 0.5%CVE-2026-59148HIGHMockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theftEPSS 0.3%